Trains Are A Cyber Security Risk

Cyber security concerns are increasing along with political tensions, and because critical infrastructures might be at risk from cyber hacks.

So far, attacks used to be limited mainly to Distributed Denial-of-Service (DdoS) attacks that only cause short-term nuisance, but there is real damage that hackers could potentially cause to infrastructures, such as transportation.

Defense against cyber threats of critical infrastructure is now a very significant part of national security, since enemy nations can use ransomware or other types of threats to hack into important networks that are used for purposes like transportation.

The dramatic increase in such threats against rail systems has led to a rise of concern among cyber security experts.

Turns out that the ability to “hack a train” is more real than you think- modern trains and railways have complex digital systems for control and navigation, and everything that’s digital on them can also be hacked.

Malicious actors can disrupt the functioning of trains, ranging from stopping them or manipulating their speeds to sabotaging operations by tampering with railway switches or even causing intentional collisions.

North Korea has reportedly tried to hack South Korea’s rail transit systems and similarly, ransomware has been used to shutdown metro operations in Germany and San Francisco.

Rail systems can be vulnerable in the operations of the tracks which involve a complicated process, the ticketing systems could also be targeted or the safety features of the train can be compromised.

In October 2017, a DDoS attack hit Sweden's transportation network, crashing the system that monitors the trains’ locations, as well as taking down email systems, websites and road traffic maps. Passengers were unable to make reservations or receive updates regarding train status and delays.

More recently in 2022, there was a case in Denmark when trains were stopped for a couple of hours because a third-party IT service provider was hit by a ransomware attack.

The affected company provided a mobile application that train drivers used to access critical operational information, such as speed limits and information on work being done to the railroad.

And in 2022 a hacking group stopped trains in Belarus to disrupt Russia’s military build-up in Ukraine. The attack served a political purpose and attempted to disrupt military aggression.

However, the fact that hackers were able to access such critical infrastructure is a cause for concern.

There are two main threats to railways, the operational and the non-operational environments.

The non-operational environment affects railway companies’ data, which can be stolen and exploited. An example is an attack from April 2023 on the Alaska Railroad Corporation (ARRC), during which cyber criminals stole sensitive information about the company’s vendors and employees from its systems, and a similar case also occurred in the Netherlands in March.

When it comes to the operational environment, malicious actors can disrupt the functioning of trains, which can range from stopping them or manipulating their speeds to sabotaging operations by tampering with railway switches or even causing intentional collisions.

Another different cause for concern is physical ransomware attacks where malicious actors prevent trains from moving until their ransom demands are met.

Furthermore, trains are autonomous, which makes them vulnerable. Intercity trains have very long braking distances, sometimes up to one kilometer, therefore more complex solutions are needed for train safety because they are controlled wirelessly.

Across Europe, trains use standardised train operating systems which contribute to efficiency in the railway industry. The downside of this is that it opens the door for attackers to break into these systems on a wide scale.

Another risk factor is human error- train control systems are maintained by numerous people, which increases the risks of systems being insecurely connected to the Internet or employees using laptops infected with malware.

Trains, as opposed to other industries, have a very extensive lifespan and are expected to remain in service for around 30 years. Consequently, the train control systems currently in use were designed a decade or more ago.

Furthermore, train control systems include a complex system of various elements such as switches, light signals and other components. Maintaining it is challenging, mainly when the maintenance information is either outdated or it is unclear where it is stored.

Two possible solutions are a better and more extensive monitoring system, making sure to keep up to date with the risks of the time, and not getting complacent about the safety of older tech.

iHLS:     Cyber News:     Industrial Cyber:     DXC:     Standard:     Rail Journal:     Security Week

 

If you like this website and use the comprehensive 6,500-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible

« Software Faults Ground F-35 Warplanes
British Surveillance Laws: Apple Might Withdraw Services »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Resecurity, Inc.

Resecurity, Inc.

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

Perimeter 81 / How to Select the Right ZTNA Solution

Perimeter 81 / How to Select the Right ZTNA Solution

Gartner insights into How to Select the Right ZTNA offering. Download this FREE report for a limited time only.

Gigamon

Gigamon

Gigamon provides intelligent Traffic Visability solutions that provide unmatched visbility into physical & birtual networks without affecting the performance or stability of production environments.

Covenco

Covenco

Covenco is a data management and IT infrastructure specialist. Working with customers to transform their IT environments, with data protection and security at the forefront of everything we do.

Zivver

Zivver

Zivver is the effortless, secure email platform, powering the next generation of secure communications.

Information Network Security Agency (INSA) - Ethiopia

Information Network Security Agency (INSA) - Ethiopia

INSA's vision is to realize a globally competent National Cyber capability which plays a key role in protecting the national interests of Ethiopia.

Cyber Security Malta

Cyber Security Malta

Cyber Security Malta is part of Malta's National Cyber Security Strategy which aims to combat cybercrime, strengthen national cyber defence and provide cyber security awareness and education.

Capsule8

Capsule8

Capsule8 is the only company providing high-performance attack protection for Linux production environments.

LANCOM Systems

LANCOM Systems

LANCOM Systems is the leading European manufacturer of secure, reliable and future-proof networking (WAN, LAN, WLAN) and firewall solutions for the public and private sectors.

Core Sentinel

Core Sentinel

Australia's #1 Penetration Testing Service. Make Your Systems Fully Compliant With Our OSCE CREST/CISA Certified Penetration Testing.

Secure Cyber Defense

Secure Cyber Defense

Secure Cyber Defense provides expert cybersecurity consulting and managed detection and response services to companies, local government, schools and universities.

Cyware

Cyware

Cyware is the only company building Virtual Cyber Fusion Centers enabling end-to-end threat intelligence automation, sharing, and unprecedented threat response for organizations globally.

Legit Security

Legit Security

Legit Security's mission is to secure every organization's software factory by protecting the pipelines, infrastructure, code and people for faster and more secure software releases.

Trojan Horse Security

Trojan Horse Security

Trojan Horse Security are specialists in corporate security. Our services include: Comprehensive Cyber Security Analysis, Penetration Testing, Network Security and Security Audits.

PeoplActive

PeoplActive

PeoplActive is an IT consulting and recruitment services organization with leading capabilities in digital, cloud and security.

Cyber News Live (CNL)

Cyber News Live (CNL)

Cyber News Live provide vital information and raise awareness about all things 'cyber' to ensure you stay protected in the digital world.

EPAM Systems

EPAM Systems

Since 1993, EPAM Systems has leveraged its advanced software engineering heritage to become a leading global digital transformation services provider.

Runecast Solutions

Runecast Solutions

Runecast Solutions is a global leader in AI-powered risk mitigation, security, continuous compliance and more efficient IT operations management.